Caveat: SELinux

rkt does not work with the SELinux policies currently shipped with Fedora versions 24 and 25.

As a workaround, SELinux can be temporarily disabled:

sudo setenforce Permissive

Or permanently disabled by editing /etc/selinux/config:

SELINUX=permissive

Caveat: firewalld

Fedora uses firewalld to dynamically define firewall zones.
rkt is not yet fully integrated with firewalld.
The default firewalld rules may interfere with the network connectivity of rkt pods.
To work around this, add a firewalld rule to allow pod traffic: